Hackers Claim Apple Online Data Was Compromised

A list of 27 user names and encrypted passwords apparently for an Apple website was posted to the Internet over the weekend along with a warning from hacker group Anonymous that the Cupertino-based computer maker could be a target of its attacks.

The list was posted to the Pastebin website, a hosting site for text files, by an unidentified user under the title "Not Yet Serious." It wasn't immediately clear if the user was allied with the Anonymous hacking group, but the existence of the file became widely known after Anonymous linked to it in a Twitter message.

"Not being so serious, but well," the message read before linking to the PasteBin page. "Apple could be target, too. But don't worry, we are busy elsewhere," the message said.

The data appears to be a set of user names and encrypted passwords from an SQL database for an online survey at the Apple Business Intelligence website. The site is currently offline.

Apple did not immediately respond to a request for comment.

In an apparently unrelated posting, a Lebanese grey-hat hacker called idahc_hacker said he had found vulnerabilities on another Apple website. The SQL injection and iFrame code attacks can be used by hackers to gain unauthorized access to data.

Grey hat hackers do not typically hack for malicious purposes and the Lebanese hacker did not post and data obtained from the site.

In pointing out the hacks, he said he was not part of Anonymous or LulzSec, an allied group that disbanded recently.

The Anonymous hacking group has been running an operation "Antisec" against government, law enforcement and corporations for some weeks now. A supporter of the group recently encouraged workers in "corrupt" companies and governments to also leak data. A website called HackerLeaks has been set for the purpose by People's Liberation Front, an ally of Anonymous. It is styled on the lines of whistle-blowing site WikiLeaks.

John Ribeiro covers outsourcing and general technology breaking news from India for The IDG News Service. Follow John on Twitter at @Johnribeiro. John's e-mail address is john_ribeiro@idg.com